MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78e6f6bc715bf60af689d3d3c3e8bb00dee67ae7e603d8230de38a32fa878513. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78e6f6bc715bf60af689d3d3c3e8bb00dee67ae7e603d8230de38a32fa878513
SHA3-384 hash: e378db9f054822acbd8431eba22a4f7c8c1684d82ef0b81b8282b28fcd0e2e91680716c53795e28c6bbfdd7d9360aa5d
SHA1 hash: 87250bb539d016037ad9ccb8982f074d4928f8a7
MD5 hash: 52eccafe8c203e064327034b0b4f0dbc
humanhash: alanine-violet-robin-rugby
File name:Shipment Document 2341AKI-001.xls.7z.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:646'953 bytes
First seen:2023-12-15 10:47:32 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:s5UEfFbEnu3pyubzAK8Q1yWBzyfTA11UMhLQ4IOVwLRKN/ZrffJo:smEfFlpyuBNzOTGeMhLQxwwLGfy
TLSH T12ED423179EED58E0D9FC249F022F8FDDA321E9074573698C8378F68D2A559243C349BA
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Reporter cocaman
Tags:001 7z AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: ""Khawar Yaqoob Virk" <khawar@virkgroup.com>" (likely spoofed)
Received: "from virkgroup.com (unknown [45.137.22.230]) "
Date: "15 Dec 2023 01:30:07 +0100"
Subject: "URGENT!!! PURCHASE REQ#2005632 23-41AKI-001"
Attachment: "Shipment Document 2341AKI-001.xls.7z.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Shipment Document 2341AKI-001.xls.exe
File size:857'088 bytes
SHA256 hash: 969b81f3f2aeac2cde3b76b3b823b62f071775e89af47cc00ca8687ded8f38b9
MD5 hash: f38babaecb1c7b00f67ded57fc4bf500
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.7z_xls.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed remcos
Link:
https://www.filescan.io/uploads/657c2ee2b290743934e5bd89/reports/25c05a69-13ee-465b-8655-cd2ebf617bb0/overview
Verdict:
Malicious
Labled as:
Mal/Drod7zip
Link:
https://www.hybrid-analysis.com/sample/78e6f6bc715bf60af689d3d3c3e8bb00dee67ae7e603d8230de38a32fa878513
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78e6f6bc715bf60af689d3d3c3e8bb00dee67ae7e603d8230de38a32fa878513/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-15 05:29:18 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
19 of 36 (52.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdtpnpdrlp3av5uj2pj4h2f3adpom6xh4yb5qiyn4ofdf6uhqujq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/78e6f6bc715bf60af689d3d3c3e8bb00dee67ae7e603d8230de38a32fa878513

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 78e6f6bc715bf60af689d3d3c3e8bb00dee67ae7e603d8230de38a32fa878513

(this sample)

AgentTesla

Executable exe 969b81f3f2aeac2cde3b76b3b823b62f071775e89af47cc00ca8687ded8f38b9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 969b81f3f2aeac2cde3b76b3b823b62f071775e89af47cc00ca8687ded8f38b9
  
Dropping
AgentTesla
  
Dropping
MD5 f38babaecb1c7b00f67ded57fc4bf500

Comments